Alternatives to sharing COVID-19 data with law enforcement: Recommendations for stakeholders

Highlights • In jurisdictions around the world, police have been enforcing COVID-19-related measures.• Researchers and civil society agree: criminalizing illnesses does more harm than good.• We describe two North American jurisdictions that share coronavirus data with police.• COVID-19 data policies will likely have broad ramifications for health data policy.• We present seven concrete alternatives to sharing health data with law enforcement.


COVID-19 data and the police
It is against best practice and the public interest to share identifiable health data with police, even during pandemic emergencies.However, during the COVID-19 pandemic, in some jurisdictions, police have become involved in enforcing emergency orders and public health measures [1].As part of this, several jurisdictions in the U.S. and Canada have established COVID-19 data sharing protocols with law enforcement agencies [2][3][4][5].Historical scholarship [6], legal analysis [7][8][9], public health best practice [10], social science [11,12], and criminology research [13,14] have consistently demonstrated that using criminalization and law enforcement approaches in disease control overwhelmingly does more harm than good and disproportionately impacts the most vulnerable [15,16].This is reflected in the civil society consensus against using criminalization to manage COVID-19.Groups such as The United Nations Joint Programme on HIV/AIDS [17], HIV Justice Worldwide [18], The American Civil Liberties Union [19], Canadian Civil Liberties Association [20], and black and indigenous legal advocacy organizations [21], have engaged in stakeholder education aimed at communicating the harmful effects of using police to enforce public health measures.
The European Data Protection Board (EDPB), the entity charged with ensuring consistent enforcement of the E.U.General Data Protection Regulation (GDPR), has also issued guidelines against the re-disclosure of COVID-19 contact tracing data to law enforcement [22].The EDPB notes that re-uses of COVID-19 data during declared states of emergency should be accompanied by "adequate safeguards, such as granting individuals the right to judicial remedy," [23] and that sharing data for "law enforcement purposes" is "unrelated to the management of the COVID-19 health crisis."[22, p. 7] The consensus against the criminalization of COVID-19 and against disclosures of COVID-19 data to law enforcement follows decades of research and best practices that demonstrate the importance of keeping the work of public health and the police separate, and of ensuring that health information stays within the health system.
We are social scientists who study HIV criminalization, public health surveillance, opioid control, and health information technology (IT) in the U.S. and Canada.Herein, we provide information on the harms of using police and punitive measures to manage illnesses, and particularly on the harms of sharing health data with law enforcement.We draw lessons from academic research, the HIV decriminalization and harm reduction movements, regulatory actions by EDPB related to COVID-19, and from critiques of law enforcement-driven pandemic preparedness strategies [9].Our findings and recommendations have broad relevance for health policy stakeholders, particularly in countries with highly interoperable health IT ecosystems that facilitate various forms of health data exchange.
Below, we review the literature and offer two case studies of North American jurisdictions -Minnesota and Ontario -whose public health authorities have established data sharing protocols with law enforcement.We then present seven alternatives to sharing COVID-19 data with police, while facilitating interoperability with healthcare first responders.These strategies can help ensure that health IT platforms do not become vehicles for the criminalization of COVID-19.This can, in turn, help to ensure that public health principles such as balancing individual rights against the public good are observed during the COVID-19 state of emergency.

Background
There is abundant evidence that using criminal statutes and punitive measures against people living with chronic illnesses such as HIV harms them and their communities, who are often among the most marginalized [24].The same is true for opioid control, in which criminalization perpetuates the misconception of substance use as an individual moral failing and crime, rather than a biopsychosocial phenomenon and public health issue [25,26].Similarly, the over-use of police powers in pandemic preparedness for respiratory illnesses has been flagged as an area of concern by civil liberties advocates [9].Additionally, associating illnesses with marginalized groups is a longstanding and harmful effect of pandemics, and this has occurred in the case of COVID-19 for Asian people as the result of xenophobic discourse surrounding the virus's origin in Wuhan, China [27].Using law enforcement to manage public health problems creates environments of fear and cycles of punishment that harm affected people and do not support positive behavioral changes [28].For example, multiple cases of HIV-related criminal punishment stemming from alleged nondisclosure to sexual partners have resulted in the release of individuals' names and HIV status to the public by law enforcement, often working with public health agencies [28].In addition to being inhumane, this further stigmatizes HIV, erodes public trust in public health, and has led criminalized people to experience physical and psychological violence.The history of HIV criminalization demonstrates why police have no business knowing individuals' health status [29].
However, globally, police have enforced COVID-19 control measures.Citations and arrests have been reported in the U.S., Canada, the E.U., Latin America, and other regions [30,31].The U.S. Department of Justice has issued guidance for prosecuting individuals for COVID-19 violations that includes terrorism provisions [32], and some jurisdictions have enforced COVID-19 measures with criminal charges involving fines, periods in jail, or both [33].While activities that violate COVID-19 measures such as shelter-inplace, social distancing, and self-isolation should be discouraged, non-compliance is not an adequate justification to criminalize an individual for having COVID-19 or to share a person's health data with police.COVID-19 policing also disproportionately affects communities of color, which have higher rates of COVID-19 as the result of systemic racism [34].At the beginning of June, the London Metropolitan Police released data indicating that Black and Asian people were more likely to be targeted and fined with COVID-19 emergency laws than white people [35].A month earlier, the New York City Police Department (NYPD) released data on COVID-related enforcement, revealing that 81 percent of the NYPD's summonses related to physical distancing have gone to Black and Latinx people [36].It was further revealed that 35 of 40 people arrested by the NYPD for alleged physical distancing failures were Black [37].
In the U.S., Canada, E.U., and internationally, there are few legal and ethical justifications for giving individuals' health information to law enforcement without consent or a court order.[38,39, p. 14, 22, p. 4], Without consent, identifiable COVID-19 data should only be shared with law enforcement in the most extraordinary circumstances, requiring a court order.Otherwise, sharing COVID-19 patient data with criminal justice entities should be limited to those involved in the provision of healthcare, housing/detention, medical transport, or other services.We agree with other researchers and legal scholars that states of pandemic emergency do not justify implementing protocols to criminalize illnesses or to share individuals' health data with police [9,40].

Minnesota and Ontario, April 2020: sharing identifiable COVID-19 data with police
Actions taken by the North American jurisdictions of Minnesota and Ontario in April 2020 show how sharing COVID-19 data with police has become routine in two large regions covering urban, rural, and indigenous territories.

Minnesota: COVID-19 addresses shared daily with emergency dispatchers
On April 1st, 2020 three Minnesota law enforcement associations requested that Governor Tim Walz direct the state government to share COVID-19 data with first responder agencies [41].On April 10th, Governor Walz signed an executive order that directed the state Department of Public Health (DPH) to work with the state Department of Public Safety (DPS) to make a plan to share the addresses of positive cases of COVID-19 with 911 emergency dispatchers [2].The order emphasized limited data sharing, and that individuals' names would not be included.On April 20th, Minnesota DPH and DPS released a protocol (excerpt shown in Fig. 1) describing how the addresses of "each 'positive COVID-19 case,'" would be shared with 911 dispatchers around the state every day [42].On April 21st, Minnesota DPH and DPS held webinars to instruct personnel about how to implement the protocol [43].The protocol allows for the sharing of COVID-19 data with all first responder agencies through the 911 infrastructure, utilizing Computer Aided Dispatch (CAD) systems.The protocol defines "'first responders and other public safety personnel'" as "emergency medical services personnel, ambulance transport staff, law enforcement personnel, fire responders, fire inspectors, and probation officers and parole agents."[42] The protocol also trains dispatchers on how to screen people for COVID-19 symptoms.
The protocol is narrowly written, only directing dispatchers to share COVID-19 data "after exhausting other sources of information (e.g., the screening protocol above) and when a first responder has an emergent need to know the shared data."[42] The protocol also requires that Minnesota DPH remove "addresses that are no longer 'positive COVID-19 cases'" and to remove cases as part of daily list updates sent to dispatch centers [42].The protocol also states "[a]ll data must be destroyed. ..within 15 days of [the Governor's executive order] being rescinded or the expiration of the peacetime emergency, whichever occurs first."[42] Under Min- nesota law, individuals must also be given a warning that their data could be re-disclosed, and be provided an initial opportunity to refuse.[42,44].
Even with these limitations, the Minnesota protocol's procedure for sharing COVID-19 data with law enforcement without consent crosses the line into unacceptable terrain.[39, p. 14] In the absence of a court order, individuals should have a say over when their sensitive health data are disclosed to law enforcement [39, p. 14].The initial warning is not sufficient.Providing someone a single opportunity to refuse re-disclosures upon diagnosis is not equivalent to affirmative consent for specific re-disclosures [45, p. 412].The Minnesota protocol's COVID-19 screening procedure is an example of providing people with an opportunity to disclose at a specific moment in time, when asked by a 911 operator.

Ontario: police permitted to check COVID-19 status, April-August 2020
On April 3rd, 2020, in Ontario -Canada's most populous province -an order under the Emergency Management and Civil Protection Act was added to enable the sharing of individual COVID-19 positive data with police and fire authorities [3].The order allows for the sharing of an individual's name, address, date of birth, and whether they had a positive test for SARS-CoV-2 (the coronavirus that causes COVID-19)."Specified custodians" -such as laboratory and public health personnel -are permitted to share the data with entities including (but not limited to) police officers and staff, firefighters and staff, paramedics, and communicable disease communications officers [3].In addition to the Ontario Provincial Police (OPP), there are fifty municipal police services and nine First Nations police services in Ontario [46].
Waterloo Regional Police, in central Ontario, was one of the entities to adopt the protocol.In a policy, the agency notes: The disclosure of personal health information related to the COVID-19 (positive) status of an individual, must only be used to prevent, respond to or alleviate the effects of the COVID-19 emergency.This includes, ensuring appropriate measures are taken to protect police personnel when responding to a call.This information cannot be used for any other purpose.[47, p. 42] Furthermore, the policy states the data will be held in a separate database from the Canadian Police Information Centre, the country's centralized policing database [47, p. 42].
Additionally, on April 16th, police in Kingston, Ontario noted in the media that "[a]s an additional safety measure for front-line officers, Kingston police, along with other law enforcement in the province, now have a listing of all COVID-19 patients in the region, which will be available to a select number of Kingston dispatchers."[48] Neither the regulation nor the protocols discuss informing COVID-19 patients that their health data could be shared with police.Further, the data collected did not include date of diagnosis, potentially allowing data to be accessed after a person recovered from COVID-19 [21].
Across the U.S. and Canada, comprehensive testing is not being rolled out.[49,50] At the same time, COVID-19 police enforcement has increased [1].The path toward positive behavioral change lies not in policing the pandemic, but in a strong collective response rooted in ethics of care and public health best practices.Sharing individuals' health data with police works at cross-purposes with these goals [51].

Seven alternatives to sharing COVID-19 data with law enforcement
Here, we present seven alternatives to sharing COVID-19 data with law enforcement that personnel can pursue if a jurisdiction opts to implement a protocol to share coronavirus data with police.These recommendations are summarized in Table 1.We reiterate that existing evidence strongly favors not implementing any such protocols.They are far more likely to do more harm than good, potentially leading to fines, criminal charges, physical and psychological violence, discrimination, stigmatization, and improper disclosures of COVID-19 status.We also note that most police are not trained to handle sensitive health information, and that police have been known to improperly disclose information about individuals' health status.[12, pp.99-208, 28, pp.139-44] However, if a jurisdiction does implement a COVID-19 police data sharing protocol, the following strategies and policy recommendations provide potential remedies to ameliorate harms.
(1) Treat COVID-19 data as sensitive health information or public health surveillance data, and thus subject to similar restrictions on disclosures to law enforcement.A "sensitive" designation akin to data about HIV, mental health, substance use, domestic violence, abuse, and other categories of sensitive health information often comes with additional safeguards governing use, disclosure, and exchange [52, p. 25].This often includes the requirement for police and prosecutors to secure a court order or the individual's consent [53].Without a court order or consent, disclosures of identifiable COVID-19 data should not be made outside of the healthcare, research, public health, or social service sectors [39, p. 14].
(2) Implement segmented COVID-19 data interoperability with first responder agencies.Public health agencies can build interoperability loops with public safety agencies that facilitate data sharing with healthcare first responders, while preventing data sharing with police.The U.S. Interoperability Standards Advisory contains guidance on segmented interoperability for sensitive information [54].U.S. regulations requiring patient consent for the (2) Implement segmented COVID-19 data interoperability with first responder agencies.
Personnel who build systems for the transmission of COVID-19 data to first responders can construct interfaces that give access to medical first responders and not to law enforcement.
(3) Designate a panel to review applications from police for COVID-19 data.
Most health departments and systems have ethics review panels.These can be used to review applications from police for COVID-19 patient data.Ideally, these panels will include community voices, such as people from disparity groups and/or who have had COVID-19.
Personnel can refuse to share COVID-19 data with police.This work can be shifted to other personnel, who might themselves join in refusal.Personnel should not act without being fully informed about potential ramifications.Discussing these issues with co-workers and seeking guidance from professional associations and advocates can be good starting points.
(5) Decline to build COVID-19 data infrastructures that are interoperable with law enforcement.
Personnel can decline to build infrastructures intended to share COVID-19 data with police.
Other personnel can take on this work, or can join in refusal.Personnel should not act without being fully informed about potential ramifications.Discussing these issues with co-workers and seeking guidance from professional associations and advocates are good starting points.
(6) Advocate for policies to limit COVID-19 data sharing with police.
Advocating for internal policies at a health organization that limit COVID-19 data sharing with police is one way to advance reform.Personnel can also advocate within their professional associations for public resolutions against COVID-19 data sharing with police.
At the jurisdictional level, engaging in policy advocacy to limit COVID-19 data sharing with law enforcement is another way to advance change.Public health agencies often advise policymakers.Independent advocacy by personnel is also possible.This can involve public exposure, and some personnel may not be able to speak publicly, either for legal reasons or by choice.Working with experienced advocates -including fellow health workers, lawyers, and professional advocates -is key to ensuring legal compliance and effective strategy.
Many organizations have internal mechanisms to report abuses, such as an Inspector General or Ombudsman.These offices can be leveraged in a variety of ways to report abuses.
If a health professional uses their professional and ethical judgement to determine that a COVID-19 data-related abuse is so egregious that it must be brought to light publicly, most news outlets have anonymous tip lines.Personnel can also contact advocates who work with whistleblowers.Personnel should not act without considering the potential ramifications.
disclosure of substance use data have also provided frameworks for managing segmented interoperability [55].
(3) Designate a panel to review applications from police for COVID-19 data.An existing ethics review entity at a health agency could review individual applications from law enforcement agencies for COVID-19 data.
(4) Decline to share COVID-19 data with police.If a data custodian determines that a request for COVID-19 data is improper, they can decline to fulfill it.Stewards of COVID-19 data are within their rights to consult legal counsel.Concerning potential ramifications, individuals can contact chapters of civil rights groups in their jurisdiction or their professional association/union.Individual U.S. health workers or associations of health professionals who object to sharing coronavirus data with police on moral grounds could consider appealing to federal conscience protections [56].E.U. citizens, firms, and institutions can consult the EDPB guidelines, which direct Member States against data sharing with law enforcement [22, p. 7].
(5) Decline to build COVID-19 data infrastructures that are interoperable with law enforcement.Personnel asked to build COVID-19 systems or protocols that facilitate interoperability with police can decline to do so.Recently, technology workers have organized to affect the direction of firms' decisions about the ethics of building harmful tools [57].
(6) Advocate for policies to limit COVID-19 data sharing with police.By "policies," we mean both health organization policies and government policies that limit how COVID-19 data can be shared with police.Health system policies include establishing protocols within organizations to ensure that COVID-19 data are not improp-erly disclosed.Government policies include solutions sought, for example, by lobbying policymakers.Jurisdictions could adopt laws requiring consent or a court order for COVID-19 disclosure to law enforcement [53].
(7) Report improper data sharing.Individuals who believe that agencies are engaging in improper COVID-19 data sharing can report this activity.Most health organizations have internal grievance processes.
Stakeholders can also use their professional and ethical judgement to seek other means to stop COVID-19 data abuses.This occurred in Toronto.In April 2020,1 a message disclosing a person's COVID-19 positive status was sent across communication channels to operators of the Toronto Transit Commission (TTC), Canada's largest public transportation system.The message directed TCC workers to deny a woman access to the public service due to her COIVD-19 positive status: "Please do not pick up female/black/. ..Person is homeless and confirmed to be COVID-19 positive."A bus driver posted an image of the notification on Twitter.TTC replied on Twitter, saying "We acknowledge that the message sent to operators was worded inappropriately. ... We engaged with all the correct authorities to assist the individual in need." 2 It is unclear how the transit system accessed this information.However, this small action by a humane and civically-minded TCC employee was enough to instigate policy change.Advocates subsequently filed lawsuits and wrote open letters to stop COVID-19 data sharing in Ontario.In August 2020, a court put a hold on police access to the COVID-19 police database -but not before it had been accessed over 95,000 times.[58,59, pp. 22-4] Civil rights groups later alleged that some of these searches were illegal and improper, even within the approved protocol [60].The juxtaposition of forms of organized advocacy with the bus driver's act shows that everyday actions, organized resistance, and thoughtful dialogue are all critical to resisting the integration of COVID-19 data with police data.

Conclusion: keep health data in the health system
The risks of sharing COVID-19 data with law enforcement are manifold, and the benefits range from indiscernible to negative.Data stewards have a vital role to play in keeping police and health data separate.Pandemic states of emergency do not permit the suspension of basic rights of control over the disclosure of one's health data outside the health system.This is evident from the history of research on the harms of criminalizing illness, civil society consensus against the use of criminal powers in the COVID-19 response, and COVID-19 data regulations by the EDPB.
Regulations related to sharing COVID-19 data with police have been implemented partly in the name of protecting officers.However, the benefits of disclosing health information to police do not outweigh the risks, and there are measures that police agencies can take to protect their employees, and which officers can take to protect themselves.Police can wear masks, regularly wash their hands, carry hand sanitizer, engage in social distancing, and self-isolate if they display symptoms of COVID-19 or test positive.
If police want to become partners in public health responses, agencies can begin by acknowledging that they are not entitled to access individuals' health information.Until law enforcement agencies recognize this and begin building partnerships on that basis (rather than on punitive enforcement and criminalization), the work of public health and the police will remain antagonistically opposed.

Table 1
Recommendations and Considerations for Limiting COVID-19 Data Sharing with Law Enforcement.

Treat COVID-19 data as sensitive health information or public health surveillance data, and thus subject to similar restrictions on disclosures to law enforcement.
Health systems have many ways of designating data as sensitive or subject to extra restrictions.COVID-19 data are an emergent data class that has arisen at a time when many health data exchange restrictions have been relaxed under emergency powers.Health systems can adopt policies that limit COVID-19 data sharing with police by adopting frameworks used to regulate other sensitive data, such as HIV data or mental health data.